131 commands
Network CLI command reference
Every router, switch, and host command NetForge-AI actually runs — with real syntax, a copy-paste example, and the gotcha that trips people up. Unlike a static cheat-sheet, each command is one click from a live simulator, so you can type it and watch the network react.
Navigation
- enableEnter privileged exec mode (R1> → R1#). Required before any 'show' or 'configure' command.
- disableReturn to user-exec mode (R1# → R1>).
- configure terminalEnter global configuration mode. Aliased as 'conf t'.
- exitStep out of the current submode (iface → config → enable → user).
- endJump straight from any config submode back to privileged exec (R1#). Shortcut: Ctrl+Z (Ctrl+C with nothing selected does the same). On a server it closes the DHCP pool and returns to the Terminal prompt.
- do <command>Run a privileged-exec command from inside config mode without exiting.
- ? / <prefix>? / <command> ?Context help, exactly like a real device: '?' alone lists every command in this mode; 'sh?' (glued) lists the commands that start with sh; 'ip ?' (spaced) lists the words that may come next, one per line. A complete command prints '<cr>'; nothing matching prints '% Unrecognized command'.
Show & diagnostics
- show running-configPrint the active configuration. Use 'show run | include ospf' to filter.
- show <command> | include <regex>Filter any show output. '| include' keeps matching lines, '| exclude' drops them, '| begin' starts at the first match, '| section' keeps a matching line and everything indented under it, '| count' counts matches.
- show startup-configPrint the saved (NVRAM) config. Empty until you run 'write' or 'copy run start'.
- show ip interface briefOne-line per interface: IP, admin status, line protocol. The single most useful verification command.
- show interfaces [iface]Detailed counters and status for one or all interfaces (MAC, bandwidth, duplex, errors).
- show interfaces statusSwitch port summary: connected / notconnect / disabled, plus access VLAN and speed.
- show interfaces switchportPer-port L2 details: administrative mode, operational mode, access VLAN, native VLAN, allowed VLANs.
- show vlan briefVLAN database with ports assigned to each. Trunks don't appear here — they carry every VLAN.
- show mac address-tableL2 forwarding table: MAC → port mapping the switch learned from frames.
- show ip routeRouting table. Codes: C=connected, S=static, O=OSPF, R=RIP, D=EIGRP. Default route shown last with *.
- show ip route <address>The one routing entry the router would use for that address — longest prefix, then lowest distance — with how it was learned.
- show ip route <protocol>Filter the route table by protocol: ospf, eigrp, rip, static, connected.
- show ip ospf neighborOSPF adjacency table — every router we've reached Full state with.
- show ip ospf interfacePer-interface OSPF state: area, cost, hello/dead timers, passive flag.
- show ip eigrp neighborsEIGRP adjacency table for the current AS.
- show ip protocolsSummary of every dynamic-routing process configured on this router.
- show arpARP cache: IP → MAC mappings learned from ping/data traffic.
- show cdp neighbors [detail]List directly-connected neighbours discovered via CDP. 'detail' adds their IP and platform.
- show lldp neighbors [detail]Same as CDP but uses LLDP (IEEE 802.1AB) — works across vendors.
- show spanning-treeSTP state: root bridge, port roles, port states.
- show ip dhcp bindingActive DHCP leases this router or server has handed out.
- show versionHardware model, OS version, uptime, interface counts.
Basic config
- hostname <name>Rename the device. The prompt updates immediately.
- enable secret <password>Set the encrypted password required to enter privileged mode.
- enable password <password>The legacy privileged-mode password, stored in plain text (type 7 once 'service password-encryption' is on).
- banner motd <delim>text<delim>Message-of-the-day shown to anyone connecting. Delim character marks start and end.
- ip domain-name <name>Domain suffix for the device (also required before 'crypto key generate rsa' for SSH).
- service password-encryptionHash all clear-text passwords in running-config (Type 7).
- username <user> [privilege N] secret <pwd>Local user account for AAA/SSH/console login.
Interface
- interface <id>Enter interface config mode for one port. Names: Gi0/0, Fa0/1, Se0/0/0, Vlan10, Gi0/0.10, Loopback0, Dot11Radio0.
- ip address <ip> <mask>Assign an IPv4 address. Use dotted-decimal mask, not prefix length.
- ip address dhcpAcquire the address via DHCP rather than hard-coding it.
- no shutdownAdministratively enable the interface. Required after configuring a router port.
- shutdownAdministratively disable the interface (admin-down).
- description <text>Free-form label for the port, visible in 'show interfaces description'.
- delay <tens-of-usec>Set the interface delay EIGRP feeds into its composite metric (units of 10 µs). Raising it makes routes through this link less preferred.
- interface Loopback <N>Create a virtual interface that's always up — perfect for stable router-IDs.
- interface <iface>.<sub>Create a subinterface for router-on-a-stick (inter-VLAN routing).
- encapsulation dot1Q <vlan>Tag the subinterface with this VLAN ID. Must match the trunk's allowed VLAN.
Switching (VLAN/STP)
- vlan <id>Create or enter a VLAN. Range 1-4094. VLAN 1 is the default.
- switchport mode accessLock the port into access mode — carries one untagged VLAN. For end-host ports.
- switchport access vlan <id>Place the access port in the given VLAN.
- switchport mode trunkSet the port to trunk — carries 802.1Q-tagged frames for multiple VLANs. For switch-switch / switch-router links.
- switchport trunk allowed vlan <list>Limit which VLANs traverse the trunk. Use 'add'/'remove' to modify.
- switchport trunk native vlan <id>Native VLAN — frames in it cross the trunk untagged. Must match on both sides.
- interface vlan <id>Create an SVI — the L3 interface for that VLAN. With 'ip routing' on, the switch routes between its SVIs; without it an SVI is only a management address.
- ip routingTurn on IPv4 routing on a multilayer switch, so its SVIs route between VLANs.
- state {active | suspend}Suspend a VLAN — it forwards nothing and 'show vlan brief' reads 'suspended' — or make it active again.
- spanning-tree portfastSkip listening/learning on this port — only safe for end-host ports.
- spanning-tree bpduguard enableShut the port down if it receives a BPDU — protects PortFast ports.
- spanning-tree mode rapid-pvstUse Rapid-PVST+ (fast STP per VLAN). Default since 2003.
Wireless
- dot11 ssid <name>Create or edit an SSID profile on the access point and enter SSID config mode, where its security is set.
- authentication key-management wpa version 2Make the SSID a WPA2 network: only stations that present its pre-shared key may associate.
- wpa-psk ascii <key>Set the SSID's WPA2 passphrase. Every station must join with exactly the same key; it is case-sensitive.
- guest-modeBroadcast the SSID's name in the AP's beacons so it shows in a laptop's network list. 'no guest-mode' hides it.
- interface Dot11Radio0Enter configuration for the access point's radio, where SSIDs are bound and the channel and cipher are set.
- encryption mode ciphers aes-ccmSet the radio's data cipher to AES-CCMP, the cipher WPA2 is built on. Typed under interface Dot11Radio0.
- ssid <name>Bind an SSID profile to the radio so the AP actually advertises it. Typed under interface Dot11Radio0.
- channel <number>Set the radio's channel. On 2.4 GHz, 1, 6 and 11 are the three channels that don't overlap.
- station-role rootRun the radio as an access point that serves wireless clients, which is the factory default.
- show dot11 ssidNetForge lab view: one line per SSID profile with its security, broadcast or hidden, and whether it is bound.
- show dot11 associationsList the wireless stations linked to this AP's radio, the SSID each one asked for, and whether its key matched.
Routing
- ip route <network> <mask> <next-hop>Add a static route. Supports next-hop IP or exit-interface, optional AD.
- ip route 0.0.0.0 0.0.0.0 <next-hop>Default route — sends anything not matched elsewhere out to the next hop.
- router ospf <pid>Enter OSPF process configuration. PID is locally significant — does NOT need to match peers.
- network <ip> <wildcard> area <id>Enable OSPF on every interface whose IP matches. Wildcard = inverted mask.
- router-id <a.b.c.d>Hard-code OSPF router ID. Else router picks highest loopback or active interface IP.
- passive-interface <iface>Send no Hellos out this interface (still advertises the subnet). Use on user-facing ports.
- router eigrp <AS>Enter EIGRP process for the given autonomous system. AS must match between neighbors.
- router ripEnter RIP process config. Then 'network <classful-net>' enables RIP on matching interfaces.
- ip default-gateway <ip>Set the gateway on a non-routing device (L2 switch, endpoint).
Services
- ip dhcp pool <name>Create a DHCP pool. Inside the pool define network, default-router, dns-server, etc. A switch serves the subnet of the SVI in the client's VLAN, so that SVI must be up with an address inside the pool's network.
- ip dhcp excluded-address <start> [end]Reserve addresses (typically the gateway and server IPs) so DHCP won't hand them out.
- lease {<days> [<hours> [<minutes>]] | infinite}Set how long the pool's leases last. The default is one day.
- ip helper-address <server>Relay DHCP broadcasts arriving on this interface to a DHCP server in another subnet.
- ip nat inside / outsideTag the interface as the inside (private) or outside (public) side of NAT.
- ip nat inside source list <acl> interface <iface> overloadPAT — many private hosts share one public IP (the outside interface).
- ntp server <ip>Sync the device clock to an NTP server.
- ntp master [stratum]Make this device an authoritative NTP time source on its own clock, at stratum 1-15 (8 when omitted).
Security
- access-list <10-99> {permit|deny} <src> <wild>Numbered standard ACL — matches source IP only. Final implicit deny.
- ip access-list extended <name>Named extended ACL — matches src + dst + protocol + ports. Modern preferred form.
- ip access-group <acl> in|outApply an ACL to inbound or outbound traffic on this interface.
- switchport port-securityEnable port-security to limit which/how many MACs can use the port.
- switchport port-security maximum <n>Allow at most N MAC addresses on this port.
- switchport port-security violation {shutdown|restrict|protect}What happens when a MAC the port doesn't allow sends a frame. shutdown (default) err-disables the port until 'shutdown' + 'no shutdown'; restrict drops and counts it; protect drops silently.
- switchport port-security mac-address {<H.H.H>|sticky}Pin an allowed MAC by hand, or let the port remember the MACs it learns ('sticky') so they survive in running-config.
- ip dhcp snoopingEnable DHCP snooping globally; add 'ip dhcp snooping vlan <id>' per VLAN and 'ip dhcp snooping trust' on the uplink toward the real server.
- ip arp inspection vlan <id>Dynamic ARP Inspection — validate ARP replies on those VLANs against the DHCP-snooping binding table.
- line vty 0 4Configure the five VTY (telnet/SSH) lines.
- line console 0Configure the console line (the cable you're typed in on). 'line con 0' works too.
- password <password>Set the line password that 'login' checks. Shown as 'password 7 …' once 'service password-encryption' is on.
- loginRequire the line password at login. 'login local' checks the username database instead.
- exec-timeout <minutes> [seconds]Log an idle session out after this long. The default is 10 minutes; 'exec-timeout 0 0' never times out.
- logging synchronousReprint your half-typed line after a log message interrupts it.
- transport input sshAllow only SSH (not telnet) on the VTY lines.
- login localAuthenticate VTY/console users against the local 'username' database.
- crypto key generate rsaCreate the RSA key pair SSH needs. Requires 'ip domain-name' first.
Lifecycle
Connectivity tests
Endpoint shell
- ipconfig [/all]Windows-style adapter info. '/all' adds MAC, DHCP, DNS; '/renew' and '/release' work the DHCP lease; '/flushdns' clears the resolver cache; '/?' prints the usage. 'ipconfig <adapter>' shows just that adapter.
- ipconfig <ip> <mask> [gateway]Set a static address on the primary NIC in one line, with an optional default gateway. The mask may be dotted (255.255.255.0), a bare prefix (24) or /24, or written onto the address as 10.0.0.5/24.
- ipconfig <iface> ssid <name> [psk <key>]Join a Wi-Fi network from a PC or server: names the SSID (and WPA2 passphrase) on the Wi-Fi adapter and switches it on.
- ifconfigLinux-style adapter info — flags, addresses, MAC.
- ip aModern Linux address listing. Shows NO-CARRIER when the cable isn't plugged in.
- ip routeLinux routing table. Connected subnets only appear for interfaces with carrier.
- ip neighLinux ARP cache equivalent.
- arp -aShow ARP cache. Empty until you run a ping that resolves a MAC.
- route printWindows-style route table.
- tracert <ip>Windows traceroute.
- mtr <ip>Continuous traceroute (Linux). Same effect as tracert in the simulator.
- arping <ip>Single ARP probe — verifies L2 reachability without ICMP.
- ethtool <iface>Show NIC capabilities and 'Link detected' (real carrier status).
- dig <name>DNS lookup. Returns NXDOMAIN unless the simulator has a host registered.
- nslookup <name>DNS lookup (Windows-flavoured output).
- ssModern netstat — listening sockets and connections. '-i' for interface stats.
- netstat -rSame as 'route -n' — kernel route table.
- dhclientRenew the DHCP lease. Triggers a full DORA exchange visible in the capture tab.
- hostname [new]Show or set the host name.
- cat /etc/resolv.confShow DNS resolver configuration.
- uname -aKernel and host info — the simulator reports NetForge Linux.
- clear / clsWipe the terminal transcript.